<?php declare(strict_types=1); require_once __DIR__ . '/core/bootstrap.php'; if (!isset($_SESSION['auth_phase']) || $_SESSION['auth_phase'] < 1) { header('Location: login.php'); exit; } if (($_SESSION['phase1_ip'] ?? '') !== $_SERVER['REMOTE_ADDR']) { $_SESSION = []; session_destroy(); header('Location: login.php'); exit; } if (time() - ($_SESSION['phase1_time'] ?? 0) > 600) { $_SESSION = []; session_destroy(); header('Location: login.php'); exit; } if ($_SESSION['auth_phase'] >= 2) { header('Location: login3.php'); exit; } /* TIER_OWNER removed - use numeric roles */ /* TIER_ADMIN removed - use numeric roles */ if ($_SERVER['REQUEST_METHOD'] === 'POST') { header('Content-Type: application/json'); $submitted_csrf = $_POST['_csrf'] ?? ''; if (!CSRF::validate($submitted_csrf)) { http_response_code(403); exit(json_encode(['success' => false, 'error' => 'Security token expired. Refresh the page.'])); } $username = trim($_POST['username'] ?? ''); $password = $_POST['password'] ?? ''; if ($username === '' || $password === '') { exit(json_encode(['success' => false, 'error' => 'Both fields required.'])); } $result = AuthChain::validateCredentials($username, $password); if ($result['success']) { exit(json_encode(['success' => true, '_csrf' => $result['_csrf']])); } else { exit(json_encode(['success' => false, 'error' => $result['error']])); } } $csrf = CSRF::token(); ?> <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="csrf-token" content="<?= htmlspecialchars($csrf) ?>"> <title>Secure Access</title> <style> *{margin:0;padding:0;box-sizing:border-box} body{min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0a0e1a;font-family:'Inter','Segoe UI',system-ui,sans-serif;color:#c8ccd4;overflow:hidden} body::before{content:'';position:fixed;inset:0;background:radial-gradient(ellipse at 50% 0%,rgba(30,60,114,.3),transparent 70%);pointer-events:none} .auth-card{background:rgba(16,20,34,.92);border:1px solid rgba(255,255,255,.06);border-radius:16px;padding:36px 32px 28px;width:360px;text-align:center;backdrop-filter:blur(20px);box-shadow:0 8px 40px rgba(0,0,0,.5)} h1{font-size:22px;font-weight:700;color:#e2e6ed;margin-bottom:6px;letter-spacing:.5px} .phase-dots{display:flex;gap:8px;justify-content:center;margin-bottom:18px} .phase-dot{width:10px;height:10px;border-radius:50%;background:rgba(255,255,255,.15)} .phase-dot.current{background:#e6a817} .phase-dot.complete{background:#22c55e} .subtitle{font-size:13px;color:rgba(200,204,212,.5);margin-bottom:18px} #error{color:#ef4444;font-size:13px;min-height:20px;margin-bottom:4px} .field{width:100%;padding:14px 16px;background:rgba(255,255,255,.04);border:1px solid rgba(255,255,255,.08);border-radius:10px;color:#e2e6ed;font-size:15px;font-family:inherit;margin-bottom:12px;outline:none;transition:border-color .2s} .field:focus{border-color:rgba(230,168,23,.4)} .field::placeholder{color:rgba(200,204,212,.3)} .submit-btn{width:100%;padding:14px;border:none;border-radius:10px;font-size:15px;font-weight:600;cursor:pointer;transition:all .2s;background:linear-gradient(135deg,#22c55e,#16a34a);color:#fff;letter-spacing:.5px} .submit-btn:hover{transform:translateY(-1px);box-shadow:0 4px 20px rgba(34,197,94,.3)} .submit-btn:active{transform:translateY(0)} .submit-btn:disabled{opacity:.4;cursor:not-allowed;transform:none;box-shadow:none} @keyframes shake{0%,100%{transform:translateX(0)}20%,60%{transform:translateX(-6px)}40%,80%{transform:translateX(6px)}} .shake{animation:shake .4s ease} .loading{pointer-events:none;opacity:.6} </style> </head> <body> <div class="auth-card" id="auth-card"> <h1>Secure Access</h1> <div class="phase-dots"><span class="phase-dot complete"></span><span class="phase-dot current"></span><span class="phase-dot"></span></div> <div id="error"></div> <p class="subtitle">Administrator credentials</p> <form id="cred-form" autocomplete="off"> <input type="password" class="field" id="f-user" placeholder="Identity" autocomplete="off" spellcheck="false" required> <input type="password" class="field" id="f-pass" placeholder="Passphrase" autocomplete="new-password" required> <button type="submit" class="submit-btn" id="connect-btn">Connect</button> </form> </div> <script src="/assets/js/inline/login2.js"></script> </body> </html>